fixed bug where users can login without password